Data Subject Access Request

A data subject access request (DSAR) is a person's formal request to see the data an organization holds about them — the practical exercise of the “right of access” to one's personal data.

A DSAR is where a privacy right turns from a paper principle into an operational duty: the organization must be able to find, gather and hand over a specific person's data, and that “finding” is sometimes harder than it looks because one person's data may be spread across several systems. For web analytics there is a special wrinkle: the tool usually does not have the visitor's real identity, only a technical, anonymous identifier, so “this person's data” often cannot be tied to a specific individual without the site owner's help. The legal point is that in the processor-controller relationship, the request usually comes through the controller (the site owner) and the processor responds on their instruction, not directly to the visitor.